# I need pass traffic between my offices which are connected via OpenVPN and have 3 networks
# 192.168.1.0/24, 192.168.197.0/24 and 192.168.2.0/24 (this server have 2nd network card in this office)

# 1. I need give access to some users to terminal servers located in each office (80, 1494 ports defined in table <terminals>)
# 2. I need give access to external (WAN) services to some users (defined in table <internet>)

# phisical interface wich used for creating openvpn tunnel over ethernet
vpn_if="rl0"

# internal ethenet interface
int_if="rl1"

# OpenVPN tunnel interface
ext_if="tun0"

# terminal server in this office
$first_ts = "192.168.2.1"

# terminal server in 2nd office
$second_ts = "192.168.1.1"

# terminal server in 3rd office
$third_ts = "192.168.197.2"

# address for access to more services (such www, pop3, smtp)
table <internet> {192.168.2.29, 192.168.2.26, 192.168.2.22, 192.168.2.1} persist
table <tsclient> {192.168.2.29, 192.168.2.26} persist

set skip on { lo }

scrub in

antispoof quick for { lo $int_if}

# block all
block log all

# Passing traffic to VPN server on 5000/tcp

pass out on $vpn_if inet proto {tcp} from ($ext_if:0) to any port 5000 keep state

# pass all ICMP 
pass inet proto icmp all keep state

# pass SSH
pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state
pass in on $int_if inet proto tcp from ($int_if:network) to ($int_if) port ssh keep state

pass in on $ext_if inet proto tcp from <tsclient> to $first_ts port {80, 1494} keep state
pass in on $int_if inet proto tcp from ($int_if:network) to {$second_ts, $third_ts} port {80, 1494} keep state
pass out on $ext_if inet proto tcp from <tsclient> to {192.168.1.0/24, 192.168.197.0/24} port {80, 1494, 3389} keep state

pass out on $ext_if from <internet> to any port {80, 110, 25}
pass in on $int_if from <internet> to any port {80, 110, 25}